CVE-2017-5193

The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick.

The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick.

In irssi before 0.8.21, a NULL pointer dereference in the nickcmp function (CVE-2017-5193).

In irssi before 0.8.21, use after free when receiving invalid nick message (CVE-2017-5194).

In irssi before 0.8.21, out of bounds read in certain incomplete control codes (CVE-2017-5195).

In irssi before 0.8.21, out of bounds read in certain incomplete character sequences (CVE-2017-5196).

In irssi before 0.8.21, out of bounds read when printing certain values (CVE-2017-5356).

irssi was updated to fix four vulnerabilities that could result in denial of service (remote crash) when connecting to malicious servers or receiving specially crafted data. (boo#1018357)

• CVE-2017-5193: NULL pointer dereference in the nickcmp function
• CVE-2017-5194: out of bounds read in certain incomplete control codes
• CVE-2017-5195: out of bounds read in certain incomplete character sequences
• CVE-2017-5196: Correct an error when receiving invalid nick message

irssi was updated to fix four vulnerabilities that could result in denial of service (remote crash) when connecting to malicious servers or receiving specially crafted data. (boo#1018357)

• CVE-2017-5193: NULL pointer dereference in the nickcmp function
• CVE-2017-5194: out of bounds read in certain incomplete control codes
• CVE-2017-5195: out of bounds read in certain incomplete character sequences
• CVE-2017-5196: Correct an error when receiving invalid nick message

These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.

It was discovered that the Irssi buf.pl script set incorrect permissions. A local attacker could use this issue to retrieve another user's window contents. (CVE-2016-7553)

Joseph Bisch discovered that Irssi incorrectly handled comparing nicks. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5193)

It was discovered that Irssi incorrectly handled invalid nick messages. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5194)

Joseph Bisch discovered that Irssi incorrectly handled certain incomplete control codes. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5195)

Hanno Böck and Joseph Bisch discovered that Irssi incorrectly handled certain incomplete character sequences. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5196)

Hanno Böck discovered that Irssi incorrectly handled certain format strings. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-5356)